I used wireshark to compare curl --tlsv1.0 vs --tlsv1.2

The server handshake obediently uses TLSv1.0 for servers that support it (the point is to check to validate they don't):

wget url --no-check-certificate --secure-protocol=TLSv1 behaves the same as --secure-protocol=TLSv1_2: the handshake uses TLS1_2 every time.

Obviously there is no --secure-protocol=TLS1_0. How do I force wget to obey using 1_0 not 1_2?

wget: --secure-protocol: Invalid value ‘TLSv1_0’

GNU Wget 1.17.1 built on cygwin.


Reading the source code, you can see the possibilities. This slice looks like what you want:

case secure_protocol_tlsv1:
  err = gnutls_priority_set_direct (session, "NORMAL:-VERS-SSL3.0", NULL);

case secure_protocol_tlsv1_1:
  err = gnutls_priority_set_direct (session, "NORMAL:-VERS-SSL3.0:-VERS-TLS1.0", NULL);

which (see init.c) appears to be "tlsv1_1":

static bool
cmd_spec_secure_protocol (const char *com, const char *val, void *place)
  static const struct decode_item choices[] = {
    { "auto", secure_protocol_auto },
    { "sslv2", secure_protocol_sslv2 },
    { "sslv3", secure_protocol_sslv3 },
    { "tlsv1", secure_protocol_tlsv1 },
    { "tlsv1_1", secure_protocol_tlsv1_1 },
    { "tlsv1_2", secure_protocol_tlsv1_2 },
    { "pfs", secure_protocol_pfs },
  int ok = decode_string (val, choices, countof (choices), place);
  if (!ok)
    fprintf (stderr, _("%s: %s: Invalid value %s.\n"), exec_name, com, quote (val));
  return ok;

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.